CVE-2026-56667: zitadel Cross-site Scripting
Vulnerability summary
CVE-2026-56667 is a high (CVSS 7.3) Cross-site Scripting vulnerability in zitadel. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 10-07-2026Last modifiedVulnerability information updated.
Description
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached. This issue is fixed in version 4.15.3.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- zitadel-3All versions (No fix recorded)
Zitadel1 product
- zitadel< 4.15.3
2 vendors · 2 products
